flux fleet digest — 2026-10-30 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2374 |
202 |
4975 |
183 |
-52% |
| canary-farm-1 |
12934 |
247 |
15557 |
271 |
-17% |
| control-1 |
1959 |
146 |
4597 |
124 |
-57% |
| frantech-ts |
695 |
85 |
9150 |
73 |
-92% |
| lauterbourg-01-ts |
1467 |
185 |
9442 |
162 |
-84% |
| netcup-ts |
1114 |
82 |
1691 |
108 |
-34% |
| ru-edge-1 |
1471 |
172 |
19099 |
126 |
-92% |
| sponge-01-ts |
1045 |
109 |
1209 |
99 |
-14% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
env-production-error |
222 |
66.7 |
3.3x |
| ai-devbox-1 |
phpinfo-error |
42 |
7.7 |
5.5x |
| canary-farm-1 |
config-json-error |
37 |
10.8 |
3.4x |
| canary-farm-1 |
openapi-spec-json-skeleton |
23 |
1.0 |
23.0x |
| control-1 |
docker-registry-manifest |
45 |
14.3 |
3.1x |
| control-1 |
docker-registry-tags |
45 |
14.3 |
3.1x |
| control-1 |
fake-git |
276 |
86.4 |
3.2x |
| control-1 |
fake-git-miss |
265 |
6.0 |
44.2x |
| control-1 |
webapp-config-bundle-js-error |
20 |
4.0 |
5.0x |
| control-1 |
whm-login |
20 |
6.0 |
3.3x |
| netcup-ts |
openapi-spec-json-skeleton |
22 |
2.7 |
8.2x |
| ru-edge-1 |
config-json-error |
27 |
5.0 |
5.4x |
| ru-edge-1 |
docker-registry-manifest |
60 |
15.0 |
4.0x |
| ru-edge-1 |
docker-registry-tags |
50 |
15.0 |
3.3x |
| ru-edge-1 |
openapi-spec-json-skeleton |
22 |
1.0 |
22.0x |
| ru-edge-1 |
whm-login |
24 |
7.4 |
3.2x |
| ru-edge-1 |
wp-login-credentials |
65 |
6.0 |
10.8x |
| ru-edge-1 |
wp-login-probe |
66 |
8.7 |
7.6x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
106 |
757 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 362522228887 ⟳ |
33 |
108 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-29 |
/xmlrpc.php [wp-xmlrpc-post] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → /xmlrpc.php [wp-xmlrpc-post] |
| 4b4cc0ece037 ⟳ |
24 |
168 |
ai-devbox-1,canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 5e7a5d88d947 ⟳ |
12 |
36 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,lauterbourg-01-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-20 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] |
| 7ea1125e0232 ⟳ |
9 |
126 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 2d3e95b722b5 ⟳ |
7 |
287 |
lauterbourg-01-ts |
10-24 |
/ [php2shell-root] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp |
| 0a08798abff5 ⟳ |
6 |
37 |
control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-29 |
/xmlrpc.php [wp-xmlrpc-post] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → /xmlrpc.php [wp-xmlrpc-post] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → /xmlrpc.php [wp-xmlrpc-post] |
| 1cf777711bea ⟳ |
6 |
48 |
ai-devbox-1,canary-farm-1,control-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/data.json |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/v2/backup/db-migrator/manifests/sha256:5fdcf530218051db84b4c36d55d59b86ef776f8eb3ecab7126db7a3f274d5d5f |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/v2/internal/auth-service/manifests/sha256:faebf99bbd46a474fac02d2e5165662e460ce6c4959e07f68b00b58f7dcfb2c4 |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/v2/staging/web-app/manifests/sha256:b741d0c0014788244345805bfca49a1688624cbcb0003b4bdc31928bd22e84df |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/8n4qp1ps30 |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/claude-probe-1793288344569818180.html |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/.svn/pristine/ps/ps$sha1$6b7ac7207e62dc73713c1f3915d495dee1cf59.svn-base |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/api/swagger-ui/swagger.json |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/config.test.json |
2026-10-30 03:15:51.995307-04:00 |
| canary-farm-1 |
/config/production.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/appsettings.Release.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/api-docs/swagger.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/api_docs |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/docs/swagger.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/application.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/config.staging.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/credentials.local.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/angular.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/runtime-config.json |
2026-10-30 03:15:51.995307-04:00 |
| netcup-ts |
/build/asset-manifest.json |
2026-10-30 03:15:51.995307-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 |
2026-10-30 03:15:52.130454-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3075.109 Safari/537.32 |
2026-10-30 03:15:52.130454-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0 |
2026-10-30 03:15:52.130454-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15 |
2026-10-30 03:15:52.130454-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0 |
2026-10-30 03:15:52.130454-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 8_2_2; Win64; x64) AppleWebKit/539.40 (KHTML, like Gecko) Chrome/54.0.1854 Safari/537.36 |
2026-10-30 03:15:52.130454-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36 |
2026-10-30 03:15:52.130454-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 |
2026-10-30 03:15:52.130454-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Linux; U; Android 1.5; en-us; sdk Build/CUPCAKE) AppleWebkit/528.5 (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 |
2026-10-30 03:15:52.130454-04:00 |
| lauterbourg-01-ts |
raw-fast/1 |
2026-10-30 03:15:52.130454-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
136.80.17.156 |
10008 |
5 |
5 |
10-29 11:28 |
10-29 11:52 |
- |
Google LLC |
US |
10000 |
| ai-devbox-1 |
45.138.12.35 |
384 |
2 |
372 |
10-29 05:04 |
10-29 05:04 |
- |
Tc Datacenter Limited |
LT |
0 |
| control-1 |
45.138.12.35 |
384 |
2 |
372 |
10-29 23:49 |
10-29 23:49 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
104.199.180.57 |
350 |
20 |
223 |
10-30 01:45 |
10-30 01:46 |
- |
Google LLC |
TW |
3 |
| ai-devbox-1 |
34.177.96.228 |
283 |
18 |
272 |
10-29 19:34 |
10-29 19:35 |
- |
Google LLC |
SG |
4 |
| sponge-01-ts |
9.205.248.165 |
239 |
11 |
222 |
10-29 23:30 |
10-29 23:30 |
- |
Microsoft Corporation |
DK |
0 |
| canary-farm-1 |
45.138.12.16 |
216 |
59 |
200 |
10-29 19:25 |
10-30 03:00 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
176.65.144.71 |
188 |
70 |
96 |
10-29 06:16 |
10-29 21:26 |
- |
Dedik Services Limited |
CH |
0 |
| lauterbourg-01-ts |
204.76.203.237 |
184 |
6 |
4 |
10-29 22:03 |
10-30 01:03 |
- |
Pfcloud UG (haftungsbeschran |
NL |
4 |
| ru-edge-1 |
45.138.12.16 |
177 |
51 |
169 |
10-29 19:35 |
10-30 04:58 |
- |
Tc Datacenter Limited |
LT |
0 |
| netcup-ts |
45.138.12.51 |
176 |
3 |
85 |
10-29 10:44 |
10-30 02:29 |
- |
Tc Datacenter Limited |
LT |
0 |
| control-1 |
93.123.109.107 |
171 |
17 |
167 |
10-29 17:03 |
10-29 17:06 |
- |
Techoff Srv Limited |
BG |
0 |
| netcup-ts |
185.177.72.64 |
170 |
5 |
166 |
10-29 10:52 |
10-29 10:54 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| ai-devbox-1 |
45.148.10.120 |
166 |
13 |
157 |
10-29 03:49 |
10-29 14:36 |
ipsum:1 firehol2 |
Techoff Srv Limited |
NL |
4 |
| canary-farm-1 |
193.47.62.29 |
164 |
20 |
150 |
10-29 18:42 |
10-29 18:43 |
- |
BestDC Limited |
BG |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
7 |
6 |
| control-1 |
13 |
9 |
| canary-farm-1 |
27 |
22 |
| ru-edge-1 |
13 |
10 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ru-edge-1:400x3; control-1:400x9; ai-devbox-1:400x7; canary-farm-1:400x6
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
7 |
| canary-farm-1 |
["aws"] |
14 |
| canary-farm-1 |
["ssh"] |
9 |
| ru-edge-1 |
["aws"] |
13 |
| control-1 |
["aws"] |
13 |
| canary-farm-1 |
["aws","ssh"] |
4 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2328
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
https |
1266 |
| ai-devbox-1 |
http |
1108 |
| canary-farm-1 |
http |
12227 |
| canary-farm-1 |
https |
707 |
| control-1 |
http |
1959 |
| frantech-ts |
http |
695 |
| lauterbourg-01-ts |
http |
1112 |
| lauterbourg-01-ts |
https |
355 |
| netcup-ts |
http |
1114 |
| ru-edge-1 |
http |
1471 |
| sponge-01-ts |
http |
1045 |
Top Host headers:
| sensor |
host |
events |
| canary-farm-1 |
sso.rightabouteverything.show |
11005 |
| control-1 |
38.54.2.209 |
1934 |
| canary-farm-1 |
109.123.246.142 |
1912 |
| ru-edge-1 |
130.94.89.46 |
1446 |
| ai-devbox-1 |
inference.fapthropic.com |
1403 |
| netcup-ts |
159.195.21.150 |
1101 |
| sponge-01-ts |
89.167.72.144 |
1025 |
| ai-devbox-1 |
217.15.163.226 |
945 |
| lauterbourg-01-ts |
89.116.25.211 |
932 |
| frantech-ts |
209.141.62.110 |
668 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (47 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-30 |
1959 |
146 |
| 2026-10-29 |
2048 |
153 |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
176.65.144.71 |
70 |
/kmonbaseqt596f2232 [not-handled] → /kmonbasezdf31effb5 [not-handled] → /.git/HEAD [fake-git] → /.ssh/id_ecdsa [ssh-private-key-error] → /.htpasswd [htpasswd-error] → /config/secrets.yml [rails-secrets-yml] → /credentials.yml [app-config-yaml] → /deployment.yaml [generic-ci-config] → /releases/.env [env-production] → /docker-compose.yml [docker-compose] → /debug.log [not-handled] → /.env.dist [env-production] |
Dedik Services Limited |
CH |
| canary-farm-1 |
45.138.12.16 |
59 |
/ [tarpit-module] → /.svn/entries [fake-svn-error] → /.git/config [fake-git-error] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit] → / [tarpit-disconnect] → /.git-credentials [git-credentials-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] |
Tc Datacenter Limited |
LT |
| ru-edge-1 |
45.138.12.16 |
51 |
/ [tarpit-module] → /.svn/entries [fake-svn-error] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit] → / [tarpit-disconnect] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] |
Tc Datacenter Limited |
LT |
| ru-edge-1 |
206.81.24.74 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
147.182.149.75 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ru-edge-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ru-edge-1 |
142.93.0.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
178.128.207.138 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.71.81.114 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
206.189.95.232 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ru-edge-1 |
206.189.19.19 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
157.245.113.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
68.183.9.16 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 647 sources sent credentials → 489 got a shell (76%) → 449 ran a command (92% of shell-getters, 69% of sources)
- event level: 26860 credential attempts → 22543 accepted logins → 31149 commands (138% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1424 attempts
New commands this window (91 of 6709 distinct):
| events |
IPs |
example source |
command (head) |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d916a01fd28b3dd0c4b2e9b55012b88_small_control'"'"' '"'"'check_3d916a01fd28b3dd0c4 |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d916a01fd28b3dd0c4b2e9b55012b88_small_math'"'"' "$((807*381+48))"'" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'f_check_14c7547648e7b443a96674d743a854b2() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_14c7547648e7b443a96674d743a854b2_small_fu |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_d79e365b86ca196e2e5b8e87a52cc6ca_small_control'"'"' '"'"'check_d79e365b86ca196e2e5 |
| 1 |
1 |
92.118.39.50 |
"sh -c 'set -- '"'"'check_d79e365b86ca196e2e5b8e87a52cc6ca_arg1'"'"' '"'"'check_d79e365b86ca196e2e5b8e87a52cc6ca_arg2'"'"'; printf ' |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s\n'"'"' '"'"'check_d79e365b86ca196e2e5b8e87a52cc6ca_small_done'"'"''" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_235617dddc8dc950bac3dde5f8732c31_small_math'"'"' "$((74*164+26))"'" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_235617dddc8dc950bac3dde5f8732c31_small_pid'"'"' "$$"'" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'set -- '"'"'check_42752826a3a8fb276b20379864c22e8a_arg1'"'"' '"'"'check_42752826a3a8fb276b20379864c22e8a_arg2'"'"'; printf ' |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_040d147396fe0de11c9124187bef120d_small_control'"'"' '"'"'check_040d147396fe0de11c9 |
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 18931 |
1 |
13.140.229.150 |
"echo -e "\x6F\x6B"" |
| 1291 |
3 |
77.239.124.2 |
"uname -s -v -n -r -m" |
| 1291 |
3 |
77.239.124.2 |
"uname -m | awk '{printf $1}'" |
| 686 |
411 |
103.53.158.121 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 574 |
360 |
103.71.176.25 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 223 |
3 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 223 |
4 |
195.178.110.218 |
"uptime -p" |
| 221 |
3 |
195.178.110.218 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 21511 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 658 |
345gs5662d34 |
345gs5662d34 |
| 525 |
root |
3245gs5662d34 |
| 84 |
root |
123456 |
| 75 |
pi |
raspberry |
| 69 |
intel |
123 |
| 69 |
user |
wasd |
| 35 |
support |
support |
| 22 |
admin |
admin |